[v3,1/2] modules:capabilities: automatic module loading restriction

Message ID	1492640420-27345-2-git-send-email-tixxdz@gmail.com (mailing list archive)
State	New, archived
Headers	show Return-Path: <linux-security-module-owner@kernel.org> From: Djalal Harouni <tixxdz@gmail.com> To: Linux Kernel Mailing List <linux-kernel@vger.kernel.org>, Andy Lutomirski <luto@kernel.org>, Kees Cook <keescook@chromium.org>, Andrew Morton <akpm@linux-foundation.org>, <serge@hallyn.com>, kernel-hardening@lists.openwall.com, linux-security-module@vger.kernel.org Cc: Linux API <linux-api@vger.kernel.org>, Dongsu Park <dpark@posteo.net>, Casey Schaufler <casey@schaufler-ca.com>, James Morris <james.l.morris@oracle.com>, Paul Moore <paul@paul-moore.com>, Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>, Greg Kroah-Hartman <gregkh@linuxfoundation.org>, Jonathan Corbet <corbet@lwn.net>, Jessica Yu <jeyu@redhat.com>, Rusty Russell <rusty@rustcorp.com.au>, Arnaldo Carvalho de Melo <acme@redhat.com>, Mauro Carvalho Chehab <mchehab@kernel.org>, Ingo Molnar <mingo@kernel.org>, zendyani@gmail.com, Peter Zijlstra <peterz@infradead.org>, Djalal Harouni <tixxdz@gmail.com> Subject: [PATCH v3 1/2] modules:capabilities: automatic module loading restriction Date: Thu, 20 Apr 2017 00:20:19 +0200 Message-Id: <1492640420-27345-2-git-send-email-tixxdz@gmail.com> In-Reply-To: <1492640420-27345-1-git-send-email-tixxdz@gmail.com> References: <1492640420-27345-1-git-send-email-tixxdz@gmail.com> Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk

diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt index bac23c1..318ba30 100644 --- a/Documentation/sysctl/kernel.txt +++ b/Documentation/sysctl/kernel.txt @@ -43,6 +43,7 @@ show up in /proc/sys/kernel: - l2cr [ PPC only ] - modprobe ==> Documentation/debugging-modules.txt - modules_disabled +- modules_autoload - msg_next_id [ sysv ipc ] - msgmax - msgmnb @@ -411,6 +412,28 @@ to false. Generally used with the "kexec_load_disabled" toggle. ============================================================== +modules_autoload: + +A sysctl to control if modules auto-load feature is allowed or not. +This sysctl complements "modules_disabled" which is for all module +operations where this flag applies only to automatic module loading. +Automatic module loading happens when programs request a kernel feature +that is implemented by an unloaded module, the kernel automatically +runs the program pointed by "modprobe" sysctl in order to load the +corresponding module. + +When modules_autoload is set to (0), the default, there are no +restrictions. + +When modules_autoload is set to (1), processes must have CAP_SYS_MODULE +to be able to trigger a module auto-load operation, or CAP_NET_ADMIN +for modules with a 'netdev-%s' alias. + +When modules_autoload is set to (2), automatic module loading is +disabled for all. Once set, this value can not be changed. + +============================================================== + msg_next_id, sem_next_id, and shm_next_id: These three toggles allows to specify desired id for next allocated IPC diff --git a/include/linux/module.h b/include/linux/module.h index 9ad6856..4b96c10 100644 --- a/include/linux/module.h +++ b/include/linux/module.h @@ -261,7 +261,16 @@ struct notifier_block; #ifdef CONFIG_MODULES -extern int modules_disabled; /* for sysctl */ +enum { + MODULES_AUTOLOAD_ALLOWED = 0, + MODULES_AUTOLOAD_PRIVILEGED = 1, + MODULES_AUTOLOAD_DISABLED = 2, +}; + +extern int modules_disabled; /* sysctl for explicit module load/unload */ +extern int modules_autoload; /* sysctl for automatic module loading */ +extern const int modules_autoload_max; /* sysctl max value for modules_autoload */ + /* Get/put a kernel symbol (calls must be symmetric) */ void *__symbol_get(const char *symbol); void *__symbol_get_gpl(const char *symbol); @@ -497,6 +506,8 @@ bool __is_module_percpu_address(unsigned long addr, unsigned long *can_addr); bool is_module_percpu_address(unsigned long addr); bool is_module_text_address(unsigned long addr); +int modules_autoload_access(char *kmod_name); + static inline bool within_module_core(unsigned long addr, const struct module *mod) { @@ -641,6 +652,11 @@ static inline bool is_livepatch_module(struct module *mod) #else /* !CONFIG_MODULES... */ +static inline int modules_autoload_access(char *kmod_name) +{ + return 0; +} + static inline struct module *__module_address(unsigned long addr) { return NULL; diff --git a/include/linux/security.h b/include/linux/security.h index af675b5..e274bb11 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -96,6 +96,7 @@ extern int cap_task_setscheduler(struct task_struct *p); extern int cap_task_setioprio(struct task_struct *p, int ioprio); extern int cap_task_setnice(struct task_struct *p, int nice); extern int cap_vm_enough_memory(struct mm_struct *mm, long pages); +extern int cap_kernel_module_request(char *kmod_name); struct msghdr; struct sk_buff; @@ -904,7 +905,7 @@ static inline int security_kernel_create_files_as(struct cred *cred, static inline int security_kernel_module_request(char *kmod_name) { - return 0; + return cap_kernel_module_request(kmod_name); } static inline int security_kernel_read_file(struct file *file, diff --git a/kernel/module.c b/kernel/module.c index f953df9..54cb6e0 100644 --- a/kernel/module.c +++ b/kernel/module.c @@ -282,6 +282,8 @@ module_param(sig_enforce, bool_enable_only, 0644); /* Block module loading/unloading? */ int modules_disabled = 0; +int modules_autoload = MODULES_AUTOLOAD_ALLOWED; +const int modules_autoload_max = MODULES_AUTOLOAD_DISABLED; core_param(nomodule, modules_disabled, bint, 0); /* Waiting for a module to finish initializing? */ @@ -4296,6 +4298,40 @@ struct module *__module_text_address(unsigned long addr) } EXPORT_SYMBOL_GPL(__module_text_address); +/* + * Return 0 if CAP_SYS_MODULE or if CAP_NET_ADMIN and the module is + * with a 'netdev-%s' alias. Otherwise -EPERM is returned. + */ +static int modules_autoload_privileged_access(const char *name) +{ + if (capable(CAP_SYS_MODULE)) + return 0; + else if (name && strstr(name, "netdev-") && capable(CAP_NET_ADMIN)) + return 0; + + return -EPERM; +} + +/** + * modules_autoload_access - Determine whether a module auto-load is permitted + * @kmod_name: The module name + * + * Determine whether a module should be automatically loaded or not. The check + * uses the sysctl "modules_autoload" value. + * + * Returns 0 if the module request is allowed or -EPERM if not. + */ +int modules_autoload_access(char *kmod_name) +{ + if (modules_autoload == MODULES_AUTOLOAD_ALLOWED) + return 0; + else if (modules_autoload == MODULES_AUTOLOAD_PRIVILEGED) + return modules_autoload_privileged_access(kmod_name); + + /* MODULES_AUTOLOAD_DISABLED */ + return -EPERM; +} + /* Don't grab lock, we're oopsing. */ void print_modules(void) { diff --git a/kernel/sysctl.c b/kernel/sysctl.c index 3359739..a3f6dfd 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -186,6 +186,11 @@ static int proc_taint(struct ctl_table *table, int write, void __user *buffer, size_t *lenp, loff_t *ppos); #endif +#ifdef CONFIG_MODULES +static int modules_autoload_dointvec_minmax(struct ctl_table *table, int write, + void __user *buffer, size_t *lenp, loff_t *ppos); +#endif + #ifdef CONFIG_PRINTK static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write, void __user *buffer, size_t *lenp, loff_t *ppos); @@ -661,6 +666,16 @@ static struct ctl_table kern_table[] = { .extra1 = &one, .extra2 = &one, }, + { + .procname = "modules_autoload", + .data = &modules_autoload, + .maxlen = sizeof(int), + .mode = 0644, + /* Handle pinning to max value */ + .proc_handler = modules_autoload_dointvec_minmax, + .extra1 = &zero, + .extra2 = (void *)&modules_autoload_max, + }, #endif #ifdef CONFIG_UEVENT_HELPER { @@ -2332,6 +2347,31 @@ static int proc_dointvec_minmax_sysadmin(struct ctl_table *table, int write, } #endif +#ifdef CONFIG_MODULES +static int modules_autoload_dointvec_minmax(struct ctl_table *table, int write, + void __user *buffer, size_t *lenp, loff_t *ppos) +{ + struct ctl_table t; + + /* + * Only CAP_SYS_MODULE in init user namespace are allowed to change this + */ + if (write && !capable(CAP_SYS_MODULE)) + return -EPERM; + + t = *table; + /* + * If "modules_autoload" already equals max value + * MODULES_AUTOLOAD_DISABLED which means it is disabled, + * then its value can not be changed anymore. + */ + if (modules_autoload == modules_autoload_max) + t.extra1 = t.extra2; + + return proc_dointvec_minmax(&t, write, buffer, lenp, ppos); +} +#endif + struct do_proc_dointvec_minmax_conv_param { int *min; int *max; diff --git a/security/commoncap.c b/security/commoncap.c index 7abebd7..67a6cfe 100644 --- a/security/commoncap.c +++ b/security/commoncap.c @@ -1069,6 +1069,28 @@ int cap_mmap_file(struct file *file, unsigned long reqprot, return 0; } +/** + * cap_kernel_module_request - Determine whether a module auto-load is permitted + * @kmod_name: The module name + * + * Determine whether a module should be automatically loaded due to a request + * by the current task. Returns 0 if the module request should be allowed + * -EPERM if not. + */ +int cap_kernel_module_request(char *kmod_name) +{ + int ret; + char comm[sizeof(current->comm)]; + + ret = modules_autoload_access(kmod_name); + if (ret < 0) + pr_notice_ratelimited( + "Automatic module loading of %.64s by \"%s\"[%d] was denied\n", + kmod_name, get_task_comm(comm, current), current->pid); + + return ret; +} + #ifdef CONFIG_SECURITY struct security_hook_list capability_hooks[] __lsm_ro_after_init = { @@ -1090,6 +1112,7 @@ struct security_hook_list capability_hooks[] __lsm_ro_after_init = { LSM_HOOK_INIT(task_setioprio, cap_task_setioprio), LSM_HOOK_INIT(task_setnice, cap_task_setnice), LSM_HOOK_INIT(vm_enough_memory, cap_vm_enough_memory), + LSM_HOOK_INIT(kernel_module_request, cap_kernel_module_request), }; void __init capability_add_hooks(void)

[v3,1/2] modules:capabilities: automatic module loading restriction

Commit Message

Comments

Patch